Host Intrusion Detection Method Based on Short Sequence of System Call

System call is the interface for application programs to interact with the kernel, and its security affects the security of the entire operating system. Therefore, constructing an intrusion detection system that can detect attacks during application program execution at the system call level has important application value. In this paper, we first analyze the semantic information of the system call and intrusion detection methods in the system call domain, then propose a detection method based on short sequence of the system call and deep learning techniques. In data preprocessing, we use sliding window technology to divide long system call sequences into equal-length short sequences. In order to fully utilize the semantic information between system calls, Word2vec word embedding technology is used to convert the system call into a vector representation. To reduce the false positive rate of the detection model, we train a Doc2vec model based on short sequences of the system call to construct a new dataset and train the detection model, thereby improving the detection precision of the normal type data. Finally, relevant experiments are conducted on the ADFA-LD dataset to verify the effectiveness of the proposed method in this paper.